Storage of private key for etherjs app

Question

first post here

I wanted to develop an app to automate transactions with etherjs

My question is about this part of the code:

let walletWithProvider = new ethers.Wallet(privateKey, provider);

Where, or how do you guys normally store privateKey, specially when it's not a test wallet

My first thought was to encrypt the key and store it locally on my pc, and then asking in the program's prompt for the password, but i wanted to hear about your ideas first

Answer 1

Storing private keys is always a pain, since you need them in plain text to sign transactions.

Take a look at what owasp has to say about storing:

Storage

1. Developers must understand where cryptographic keys are stored within the application. Understand what memory devices the keys are stored on.
2. Keys must be protected on both volatile and persistent memory, ideally processed within secure cryptographic modules.
3. Keys should never be stored in plaintext format. Ensure all keys are stored in cryptographic vault, such as a hardware security module (HSM) or isolated cryptographic service.
4. If you are planning on storing keys in offline devices/databases, then encrypt the keys using Key Encryption Keys (KEKs) prior to the export of the key material. KEK length (and algorithm) should be equivalent to or greater in strength than the keys being protected. Ensure that keys have integrity protections applied while in storage (consider dual purpose algorithms that support encryption and Message Code Authentication (MAC)).
5. Ensure that standard application level code never reads or uses cryptographic keys in any way and use key management libraries.
6. Ensure that keys and cryptographic operation is done inside the sealed vault.
7. All work should be done in the vault (such as key access, encryption, decryption, signing, etc).

https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html#key-management-lifecycle-best-practices

Following all those guidelines strictly can be very costly. Since you just want to automate some transactions, maybe it would be more efficient to use a Chainlink service. For example, chainlink keepers can make automated CRON jobs inside smart contracts without the hassle of storing and using private keys in a built from scratch application.

If you want to do this automation on a Cloud service, maybe using HSM from AWS is not ideal. I imagine it is very costly. You could use AWS Secret manager but it's not ideal for this specific use case.